KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-32432
10.0
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityCraft CMS Code Injection Vulnerability
VendorCraft CMS
ProductCraft CMS
Date added2026-03-20
Due date2026-04-03
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-94
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Descriptions
KEV: Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
NVD: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-08-28 03:44 UTC
Wall time45.0s
Searches4
Component defaultyes
Sources
https://nvd.nist.gov/vuln/detail/CVE-2025-32432
https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
https://censys.com/advisory/cve-2025-32432/
https://www.bleepingcomputer.com/news/security/craft-cms-rce-exploit-chain-used-in-zero-day-attacks-to-steal-data/
https://www.exploit-db.com/exploits/52525
https://github.com/Sachinart/CVE-2025-32432
https://github.com/CTY-Research-1/CVE-2025-32432-PoC
https://github.com/TheMursalin/CVE-2025-32432
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_preauth_rce_cve_2025_32432.rb
https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432
https://censys.com/advisory/cve-2025-32432/
https://www.bleepingcomputer.com/news/security/craft-cms-rce-exploit-chain-used-in-zero-day-attacks-to-steal-data/
https://www.exploit-db.com/exploits/52525
https://github.com/Sachinart/CVE-2025-32432
https://github.com/CTY-Research-1/CVE-2025-32432-PoC
https://github.com/TheMursalin/CVE-2025-32432
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_preauth_rce_cve_2025_32432.rb
QC notes
warn component_extraction: Component 'Craft CMS Image Transform Endpoint (actions/assets/generate-transform) - The image transform generation controller that processes the 'handle' object via Yii's Component::__set() behavior system, allowing insecure deserialization by abusing the mismatch between Yii's class check ($value['class']) and BaseYii::createObject() which prioritizes $type['__class'] over $type['class'].' matches or contains product name 'Craft CMS' — no specific component identified
Hunting hypothesis agent
Hunt for GET /index.php?p=admin/dashboard with PHP in query then POST to actions/assets/generate-transform with FieldLayoutBehavior/__class PhpManager gadget — session file poisoning is loggable but deserialization JSON needs WAF to detect.
Research details
ComponentCraft CMS Image Transform Endpoint (actions/assets/generate-transform) - The image transform generation controller that processes the 'handle' object via Yii's Component::__set() behavior system, allowing insecure deserialization by abusing the mismatch between Yii's class check ($value['class']) and BaseYii::createObject() which prioritizes $type['__class'] over $type['class'].
PreconditionsNetwork reachability to a Craft CMS instance running a vulnerable version (3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, or 5.0.0-RC1 to before 5.6.17); the /index.php?p=admin/actions/assets/generate-transform endpoint must be accessible (it is enabled by default); a valid asset ID is needed (can be brute-forced via 404 vs 302 response heuristics); the PHP session storage path must be at the default location (/var/lib/php/sessions/) for the session poisoning vector; no authentication or user interaction required. agent
DeliveryThe attacker delivers the exploit via HTTP requests to a vulnerable Craft CMS instance. The attack is a two-phase chain: Phase 1 - Session Poisoning: The attacker sends an unauthenticated GET request to /index.php?p=admin/dashboard with a query parameter (e.g., 'a') containing PHP code embedded in a string that will be written to the PHP session file. Craft CMS stores the raw query parameter in the session via the 302 redirect Location header. Phase 2 - Deserialization Trigger: The attacker sends a POST request to /index.php?p=admin/actions/assets/generate-transform with Content-Type: application/json containing a crafted payload. The payload includes a valid asset ID, dimensions, and a malicious 'handle' object that abuses Yii's behavior system. The handle object contains both a legitimate 'class' (craft\\behaviors\\FieldLayoutBehavior) to pass Yii's security check, and an '__class' property (yii\\rbac\\PhpManager) that overrides instantiation. The PhpManager's itemFile property points to the previously poisoned session file, causing PHP to include and execute the attacker's code. The entire attack is delivered through standard HTTP requests with no authentication, no user interaction, and can be fully automated.
Public PoCyes
PoC URLs
https://www.exploit-db.com/exploits/52525
https://github.com/Sachinart/CVE-2025-32432
https://github.com/CTY-Research-1/CVE-2025-32432-PoC
https://github.com/TheMursalin/CVE-2025-32432
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_preauth_rce_cve_2025_32432.rb Third-party repos; verify before use.
https://github.com/Sachinart/CVE-2025-32432
https://github.com/CTY-Research-1/CVE-2025-32432-PoC
https://github.com/TheMursalin/CVE-2025-32432
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_preauth_rce_cve_2025_32432.rb Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). Exploitation requires identifying a valid asset ID (typically brute-forced) and chaining two attack phases: session poisoning via GET request with PHP code in query parameter, then triggering insecure deserialization via Yii gadget chain (FieldLayoutBehavior -> PhpManager) on the generate-transform endpoint. Multiple public PoCs and Metasploit module available, lowering the skill barrier significantly.
SummaryCVE-2025-32432 is a critical pre-authentication remote code execution vulnerability in Craft CMS affecting versions 3.x (<3.9.15), 4.x (<4.14.15), and 5.x (<5.6.17). Discovered by Orange Cyberdefense CSIRT and exploited in the wild as a zero-day starting February 2025, it was chained with CVE-2024-58136 (Yii framework flaw) in an active campaign to deploy PHP file manager webshells and exfiltrate data. The vulnerability is an additional fix for CVE-2023-41892 (a previous Craft CMS RCE), indicating the original patch was bypassed. The attack vector targets the actions/assets/generate-transform endpoint and exploits a mismatch in Yii's Component::__set() method: the class check uses $value['class'] to verify the value is a Behavior subclass, but BaseYii::createObject() prioritizes $type['__class'] over $type['class'], allowing arbitrary class instantiation. The exploit chain works in two phases: (1) Session Poisoning - an unauthenticated GET request to /index.php?p=admin/dashboard with PHP code in the 'a' query parameter causes Craft CMS to store the unsanitized input in the PHP session file via the 302 redirect Location header; (2) Deserialization Trigger - a POST request to actions/assets/generate-transform with a crafted JSON payload containing a Yii behavior gadget chain (using craft\\behaviors\\FieldLayoutBehavior as the valid class and yii\\rbac\\PhpManager as __class) forces the framework to include the poisoned session file via PhpManager's itemFile property, executing the injected PHP code. The vulnerability is automatable, requires no authentication, no user interaction, and has a CVSS score of 10.0. Multiple public PoCs exist (ExploitDB 52525, GitHub repositories, Metasploit module), and it was actively exploited in the wild targeting Craft CMS 4.12.8 instances, with IOCs including IP addresses 103.106.66.123, 172.86.113.137, and 104.161.32.11. The attack was used to deploy filemanager.php (sourced from github.com/alexantr/filemanager) renamed to autoload_classmap.php, along with additional backdoors and data exfiltration tools.
Tia coverage
First reported2026-07-12
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
acsc-warns-of-global-cms-exploitation-campaign-18-cves-across-wo
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.